Overview

SentinelX 403 — scanner bypass 403/401 buatan WildanDev. Mengetes header spoofing (35 teknik), mutasi path (27 teknik), dan override HTTP method (7 teknik) dengan false-positive filtering otomatis. Cocok untuk bug bounty dan penetration testing.

sx403 adalah bagian dari ekosistem SentinelX — dibangun, diuji, dan dipakai sendiri dalam kegiatan security research sehari-hari WildanDev.

Install

$ go install github.com/SentinelXofficial/sx403@latest

Fitur Utama

35 header techniques: X-Forwarded-For, X-Original-URL, method override, dll
27 path techniques: slash tricks, encoding, case, Spring/Tomcat specific
7 method techniques: POST, PUT, PATCH, DELETE, HEAD, OPTIONS, TRACE
False-positive filtering berbasis baseline response
Concurrent workers & delay per request (WAF evasion)
Proxy support: HTTP & SOCKS5
Cookie & custom header support
Match-string confirmation & silent mode (pipe-friendly)
JSON / CSV / txt output
Self-update mechanism

Usage

Contoh pemakaian nyata dalam recon & bug hunting

Basic scan satu target

sx403 --target https://example.com/admin

Konfirmasi bypass dengan keyword di body

sx403 --target https://example.com/admin --match-string "Dashboard"

Scan dengan session cookie

sx403 --target https://example.com/admin --cookie "session=abc123"

Scan pelan buat hindari WAF rate limiting

sx403 --target https://example.com/admin --delay 200 --threads 5

Multi target dari file

sx403 --file targets.txt --threads 30 --output bypassed.txt

Teknik header saja, output JSON

sx403 --target https://example.com/admin --no-path --no-method --json out.json

Lewat Burp Suite proxy

sx403 --target https://example.com/admin --proxy http://127.0.0.1:8080

Silent mode — pipe ke tools lain

sx403 --target https://example.com/admin --silent | tee hits.txt

Custom Authorization header

sx403 --target https://example.com/admin --header "Authorization:Bearer token123"

Update ke versi terbaru

sx403 --update

Flags

Referensi lengkap semua opsi CLI

FlagDefaultDescription

Input

--target—Single URL to test

--file—File containing URLs, one per line

Request

--threads10Number of concurrent workers

--timeout10Request timeout in seconds

--proxy—Proxy URL (http:// or socks5://)

--header—Custom headers: Key:Val;;Key2:Val2

--cookie—Cookie header for all requests (e.g. session=abc123)

--delay0Delay per request in ms, per worker (WAF evasion)

Filter

--match-string—Only flag results whose body contains this string

Techniques

--no-headerfalseSkip header-based techniques

--no-pathfalseSkip path-based techniques

--no-methodfalseSkip method-based techniques

Output

--output—Save bypassed URLs to a text file

--json—Save full results as JSON

--csv—Save full results as CSV

--silentfalsePrint bypassed URLs only (pipe-friendly)

--verbosefalseShow all attempts, not just interesting ones

--no-titlefalseDisable page title grabbing

--no-sizefalseDisable content-length display

--updatefalseUpdate sx403 to the latest version

Project Structure

Arsitektur kode yang modular dan maintainable

sx403/
├── main.go
├── go.mod
├── go.sum
└── internal/
    ├── banner/     — ASCII art & version info
    ├── bypass/     — Core bypass engine (attempts, HTTP client, scanner)
    ├── color/      — Terminal color helpers
    ├── output/     — Result display, JSON/CSV export
    ├── updater/    — Auto-update via GitHub releases
    └── version/    — Version & repo constants

sx403

Overview

Install

Usage

Flags

Project Structure

Punya proyek menarik buat dibangun?